kimi/Timmy-time-dashboard
Archived
1
0
Fork 0
forked from Rockachopa/Timmy-time-dashboard
Code Pull Requests Activity

fix(security): eliminate XSS vulnerabilities in mobile.html and swarm_live.html

Browse Source 
Replace all innerHTML string interpolation with safe DOM methods
(createElement, textContent, appendChild) to prevent script injection
from user chat messages and WebSocket agent data.

Fixes: XSS-01, XSS-02
This commit is contained in:
Manus AI
2026-02-21 13:40:28 -05:00
parent c198093e06
commit f89f01140e
2 changed files with 19 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
src/dashboard/templates/mobile.html
View File

@@ -193,12 +193,17 @@ async function sendMobileMessage(event) {
chat.scrollTop = chat.scrollHeight;
}
} catch (e) {
chat.innerHTML += `
<div class="chat-message timmy">
<div class="chat-meta">Timmy</div>
<div style="color: var(--danger);">Sorry, I couldn't process that. Try again?</div>
</div>
`;
const errDiv = document.createElement('div');
errDiv.className = 'chat-message timmy';
const errMeta = document.createElement('div');
errMeta.className = 'chat-meta';
errMeta.textContent = 'Timmy';
const errText = document.createElement('div');
errText.style.color = 'var(--danger)';
errText.textContent = 'Sorry, I could not process that. Try again?';
errDiv.appendChild(errMeta);
errDiv.appendChild(errText);
chat.appendChild(errDiv);
chat.scrollTop = chat.scrollHeight;
}
}